Explainable Security

Multiple stakeholders need different explanations: Explainable Security must serve developers, analysts, users, and even consider how attackers understand systems—meaning a single explanation won't work for everyone, requiring tailored approaches for each group.

Security explanations are inherently complex: Unlike general AI explainability, XSec requires reasoning simultaneously about system models, threat models, security properties, privacy concerns, trust issues, and concrete vulnerabilities—making it fundamentally more multifaceted than other explainability efforts.

The "Six Ws" framework provides structure: The paper proposes organizing security explanations around Who (stakeholders), What (security aspects), Where (system locations), When (timing), Why (reasoning), and How (mechanisms)—offering a systematic way to ensure comprehensive security communication.

Trust requires understanding, not just transparency: Building on DARPA's XAI goals, the paper emphasizes that users need to "appropriately trust" AI systems, suggesting that mere transparency about security measures is insufficient without genuine comprehension of how and why protections work.

Security research needs a new paradigm: The paper argues that traditional security analysis lacks sufficient explainability, proposing XSec as a dedicated research direction to address how security decisions, vulnerabilities, and countermeasures should be communicated to diverse audiences.